diff --git a/scripts/install-tools.sh b/scripts/install-tools.sh
index 67c18fb..1133576 100755
--- a/scripts/install-tools.sh
+++ b/scripts/install-tools.sh
@@ -10,7 +10,7 @@
 set -euo pipefail
 
 # renovate: datasource=github-releases depName=chainguard-dev/apko
-APKO_VERSION=1.4.16
+APKO_VERSION=1.4.17
 # renovate: datasource=github-releases depName=chainguard-dev/melange
 MELANGE_VERSION=0.64.0
 
diff --git a/scripts/vuln-scan.sh b/scripts/vuln-scan.sh
index c9cd19e..1e450c8 100755
--- a/scripts/vuln-scan.sh
+++ b/scripts/vuln-scan.sh
@@ -15,7 +15,7 @@ image="$1"
 out="$(mkdir -p "$2" && cd "$2" && pwd)"
 
 # Pinned by digest; Renovate updates it (renovate.json)
-GRYPE_IMAGE="${GRYPE_IMAGE:-anchore/grype:v0.121.1@sha256:6b06708b036f74b2cd70e94b706b4586af96d1932e6ac46255940b2e39dd44a9}"
+GRYPE_IMAGE="${GRYPE_IMAGE:-anchore/grype:v0.121.2@sha256:6a36234da13f9faa327306ac0b3dab3405cfa2b4eb20c8f904125a8707863913}"
 
 docker run --rm -v /var/run/docker.sock:/var/run/docker.sock "$GRYPE_IMAGE" \
   "docker:$image" -o json -q > "$out/grype.json"